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The Listing of the Claims: 

1. (Cancelled) 

2. (Previously Presented) The method of claim 20 wherein the processing step comprises 

defining a first traffic class corresponding to the web service; 

defining at least a second traffic class corresponding to an attribute of the web service; 

and 

associating the at least a second traffic class as a child traffic class of the first traffic class 
in a hierarchical traffic classification scheme. 

3. (Original) The method of claim 2 wherein the attribute in the second defining step is an 
operation of the web service. 

4. (Original) The method of claim 2 wherein the attribute in the second defining step is a 
binding supported by the web service. 

5. (Previously Presented) The method of claim 20 wherein the web services interface definition 
document is a WSDL document. 

6. (Previously Presented) A method facilitating the classification of web services network 
traffic, comprising 

discovering, at a network device, one or more web services based on web service 
invocation messages received at the network device; 

maintaining a tracking list data structure comprising, for each discovered web service, a 
web service identifier corresponding to the web service and a transaction count associated with 
the web service; 

incrementing, responsive to a message indicating a new web services network 
transaction, a transaction count associated with the web service identified in the message; 
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presenting, in a user interface, one or more of the web service identifiers and 
corresponding transaction counts, wherein the user interface allows for selection of one or more 
web service identifiers; and 

configuring, responsive to selection of a web service identifier, a network traffic 
classification mechanism to identify the web service corresponding to the web service identifier 
by creating a traffic class identifier corresponding to the web service; creating at least one 
matching rule defining an attribute of the web service; associating the at least one matching rule 
to the traffic class identifier in the traffic classification mechanism. 

7. (Cancelled) 

8. (Previously Presented) The method of claim 6 wherein the attribute in the second creating 
step is the web service identifier corresponding to the web service. 

9. (Original) The method of claim 8 further comprising 

creating at least one additional matching rule defining an attribute of the web service. 

10. (Original) The method of claim 9 wherein the attribute in the third creating step is a 
protocol associated with the web service. 

1 1 . (Original) The method of claim 10 wherein the protocol is a web services protocol. 

12. (Original) The method of claim 10 wherein the protocol is the SOAP protocol. 

13. (Original) The method of claim 10 wherein the protocol is the HTTP protocol. 

14. (Previously Presented) The method of claim 6 further comprising 

maintaining a count of a number of data flows corresponding to each web service 
traversing the communications path. 
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15. (Original) The method of claim 6 wherein the web service identifier comprises a host name. 

16. (Original) The method of claim 6 wherein the web service identifier comprises a host name 
and a uniform resource indicator. 

17. (Original) The method of claim 6 wherein the configuring step is performed in response to a 
command from an end user. 

18. (Original) The method of claim 6 wherein the monitoring step comprises 

upon detection of a new data flow, 

parsing at least one packet in the data flow to identify the protocol attributes 
corresponding to the data flow; 

matching the identified protocol attributes to a predetermined set of web services 
protocol attributes to determine whether the data flow is web services web services data flow. 

19. (Original) The method of claim 18 wherein the parsing step comprises parsing the at least 
one packet in the data flow into a flow specification, wherein the flow specification contains at 
least one instance of any one of the following: a protocol family designation, a direction of 
packet flow designation, a protocol type designation, a binding type, a pair of hosts, a pair of 
ports, a pointer to a MIME type, a pointer to an application-specific attribute. 

20. (Previously Presented) The method of claim 6 wherein the configuring the network traffic 
classification mechanism further comprises 

receiving an interface definition document defining the attributes of the web service; 

processing the interface definition document to identify at least one traffic class 
corresponding to the web service; and 

configuring a network traffic classification mechanism to identify the at least one traffic 
class based on at least one attribute obtained from the web services definition document. 
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21 . (Original) The method of claim 20 further comprising 

subsequent to the configuring step, processing the latest interface definition document 
corresponding to the web service to determine whether changes to the configuration of the 
network traffic classification mechanism are required. 

22. (Previously Presented) An apparatus facilitating the classification of web services network 
traffic, comprising 

a packet processor operative to 

detect data flows in network traffic traversing a network; 
a traffic classification database operative to 

match data flows against a plurality of traffic classes, wherein each traffic class in 
the plurality of traffic classes is defined by at least one matching attribute; 
a web services classification module operative to 

identify web services in the data flows traversing the network; 

discover one or more web services based on web service invocation messages 
received at the packet processor; 

maintain a tracking data structure comprising, for each discovered web service, a 
web service identifier corresponding to the web service and a count of the number of web 
services network transactions detected in the data flows traversing the network; 

increment, responsive to a message indicating a new web services network 
transaction, a transaction count associated with the web service identified in the message; 

present, in a user interface, one or more of the web service identifiers and 
corresponding transaction counts, wherein the user interface allows for selection of one or more 
web service identifiers; and 

create, responsive to selection of a web service identifier, a traffic class in the 
traffic classification database for a selected web service in the data structure, wherein at least one 
matching rule associated with the traffic class includes the web service identifier associated with 
the web service. 
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23. (Original) The apparatus of claim 22 wherein the web services classification module is 
further operative to 

receive an interface definition document defining the attributes of the selected web 
service; 

process the interface definition document to identify at least one traffic class 
corresponding to the selected web service; and 

create the at least one traffic class in the traffic classification database, wherein at least 
one matching rule associated with the corresponding traffic class is based on one or more 
attributes in the interface definition document. 

24. (Original) The apparatus of claim 23 wherein the at least one traffic class is identified 
relative to the operations identified in the interface definition document. 

25. (Original) The apparatus of claim 23 wherein the at least one traffic class is identified 
relative to the bindings identified in the interface definition document. 

26. -30. (Cancelled) 

31. (Previously Presented) The apparatus of claim 23 wherein, to process the interface 
definition document, the web services classification module is further operative to 

define a first traffic class corresponding to the web service; 

define at least a second traffic class corresponding to an attribute of the web service; and 
associate the at least a second traffic class as a child traffic class of the first traffic class in 
a hierarchical traffic classification scheme. 

32. (Previously Presented) The apparatus of claim 31 wherein the attribute in the second 
defining step is an operation of the web service. 
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33. (Previously Presented) The apparatus of claim 31 wherein the attribute in the second 
defining step is a binding supported by the web service. 

34. (Previously Presented) The method of claim 6 wherein the tracking list data structure 
comprises a hash table including one or more entries, wherein each entry comprises a key value 
and a transaction count, wherein the key value is generated by applying a hashing function to a 
host name and URI pair identified in messages initiating web services network transactions. 

35. (Previously Presented) The method of claim 6 further comprising applying one or more 
bandwidth utilization controls to data flows based on the web services traffic classes associated 
with the data flows by the traffic classification mechanism. 

36. (Previously Presented) The apparatus of claim 22 wherein the tracking data structure 
comprises a hash table including one or more entries, wherein each entry comprises a key value 
and a transaction count, wherein the key value is generated by applying a hashing function to a 
host name and URI pair identified in messages initiating web services network transactions. 

37. (Previously Presented) A method of classifying web services network traffic, comprising: 

maintaining a list of traffic classes, 

wherein each traffic class is associated with a set of data flow attributes, 
wherein each traffic class comprises a list of data flows grouped together based on 
the set of data flow attributes associated with the traffic class, and 

wherein each set of data flow attributes comprises at least one application-specific 

attribute; 

receiving a data packet; 

determining a data flow to which the data packet belongs based on selected data flow 
attributes that include at least one application-specific attribute; 

determining whether the data packet is associated with a web service; 
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if the data flow is a new data flow and the data packet is associated with a web service, 

then 

determining whether the web service associated with the data packet is in a list of 
web services, and 

if the web service associated with the data packet is not in the list of web services, 
then adding the web service to the list of web services. 
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